From: Greg Hudson <ghudson@mit.edu>
Date: Wed, 8 Sep 2010 03:15:49 +0000 (+0000)
Subject: X509_verify_cert can return without setting cert_ctx.current_cert.  If
X-Git-Tag: krb5-1.9-beta1~104
X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=91a250bf1a299cedbf30e1ef5a7a33d7830e2a84;p=krb5.git

X509_verify_cert can return without setting cert_ctx.current_cert.  If
it does, don't dereference a null pointer when creating the pkiDebug
message.

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24296 dc483132-0cff-0310-8789-dd5450dbe970
---

diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
index 25104d680..bdde2e0fb 100644
--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
@@ -1319,8 +1319,11 @@ cms_signeddata_verify(krb5_context context,
         default:
             retval = KRB5KDC_ERR_INVALID_CERTIFICATE;
         }
-        X509_NAME_oneline(X509_get_subject_name(
-                              reqctx->received_cert), buf, sizeof(buf));
+        if (reqctx->received_cert == NULL)
+            strlcpy(buf, "(none)", sizeof(buf));
+        else
+            X509_NAME_oneline(X509_get_subject_name(reqctx->received_cert),
+                              buf, sizeof(buf));
         pkiDebug("problem with cert DN = %s (error=%d) %s\n", buf, j,
                  X509_verify_cert_error_string(j));
         krb5_set_error_message(context, retval, "%s\n",